#!/usr/bin/perl
# syslog-migrate.pl
# written by changfugang@feinno.com
# last modified in 2011-09-26

use POSIX qw(strftime);
#use strict;
#use warn;

my $LOGCHECK_DIR = "/usr/local/logcheck/etc";
my $date = strftime "%Y-%m-%d", localtime;
my $configdir="$LOGCHECK_DIR/config";
my @condition_array;
my $condition;

open(ONLYMAIL, "<$configdir/onlymail") or die "can't open file $configdir/onlymail";
while (<ONLYMAIL>) {
        chomp;
        push (@onlymail,$_);
}

open(KEYWORDS, "<$configdir/keywords") or die "can't open file $configdir/keywords";
while (<KEYWORDS>) {
	chomp;
	push (@condition_array,$_);
}
#push @condition_array,'fault';

for(my $i=0;$i<@condition_array;$i++) {
	$condition.=$condition_array[$i].'|';
}
chop $condition;
print $condition."\n";

open(LOG, "$LOGCHECK_DIR/tmp/check");

SCAN: while (<LOG>) {
        next SCAN if /^$/;
	if ( $_ !~ /$condition/ ) {
        open(IGNORE, ">> $LOGCHECK_DIR/tmp/ignores/ignored_logs_$date");
        print IGNORE "$_";
	close IGNORE;
        next SCAN;
        }
        @msg = split(/[ ]+/);
	($year,$month,$day) = split(/\-/,$msg[0]);
	$IP = $msg[2];
        $hostname = $msg[3];
        #print "$month\t$day\t$IP\t$hostname\n";
        $message = "";

        for( $i = 2 ; $i <= $#msg ; $i++ ){
		$msg[$i]=':' if $i == 5;
                $message .= $msg[$i] . " "; 
        }
        chop $message;
        $message =~ s/\[\d+\]//;
	$message =~ s/\Q$IP\E\s+//;
	$message = html_info($message);
        #print $message;

	$HOSTNAME=$IP;

        if ( ${$HOSTNAME}{$message} ) {
                @key = split(/[ ]+/,${$HOSTNAME}{$message});
		#print "@key\n";
		$mytime=$key[0];
                $repeats = $key[2];
                $repeats++;

                ${$HOSTNAME}{$message} = "$mytime - $repeats times(s):";
        } else {
                ${$HOSTNAME}{$message} = "$month/$day - 1 times(s):";
        }

        $hosthash{$HOSTNAME} = 1;
}

foreach ( keys %hosthash) { 
        $host = $_;
	while(($key, $val)=(each %{ $host } )){
		# make onlymail check
		my $omflag = &onlyMail($key);
		if (defined($omflag) && $omflag==1) {
            		$HOST="${host}_onlymail";
        	}else{
            		$HOST=$host;
        	}
		#print $HOST."\n";
        	open (HOSTFILE, ">> $LOGCHECK_DIR/tmp/hosts/$HOST");
                print HOSTFILE "$val $key"; 
        }
}

=all in one
foreach ( keys %hosthash) { 
        $host = $_;
        open (HOSTFILE, ">> $LOGCHECK_DIR/tmp/hosts/$host");
        while(($key, $val)=(each %{ $host } )){
                print HOSTFILE "$val $key"; 
        }
}
=cut

sub html_info{
  my $str = shift;
  chomp($str);

  for(my $i=0;$i<@condition_array;$i++) {
      if ($str =~ m/(.*)($condition_array[$i])(.*)/){
          $str = $1."<font size='3' color='red'>$2</font>".$3;
          #last;
      }
  }

  return "$str\n";
}


sub onlyMail{
    my $line=shift;
    my $flag=0;
    foreach my $onlymail (@onlymail){
        $flag=1 if $line =~ m/$onlymail/;
	last if $flag==1;
    }

    return $flag;
}

close LOG;
close HOSTFILE;
exit 0;
